> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/03-windows-security-basics/local-vs-domain-accounts.md).

# Local vs Domain Accounts

## Objective

Understand the difference between a local Windows account and an Active Directory domain account.

## Lab System

Use `CLIENT01`.

## Local Account

A local account exists only on a specific Windows computer.

A local sign-in can be represented as:

```
CLIENT01\localuser
```

The account is managed by the local computer.

## Domain Account

A domain account is stored and managed in Active Directory.

A domain sign-in can be represented as:

```
ZYBERLAB\labuser01
```

or with a user principal name, depending on the domain configuration.

The account can be used across domain-joined systems according to assigned permissions and policy.

## Compare the Accounts

On `CLIENT01`:

1. Open **Computer Management**.
2. Navigate to **Local Users and Groups** if the edition supports it.
3. Review the local users stored on the computer.
4. Open **Active Directory Users and Computers** on `DC01` and locate the domain user created earlier.

Notice that these accounts are stored in different identity databases.

## Sign-In Context

At the Windows sign-in screen, pay attention to which account source is being used.

Examples:

```
CLIENT01\localuser
ZYBERLAB\labuser01
```

Using the wrong account context is a common reason for sign-in confusion in Windows environments.

## Security Relevance

Local and domain accounts have different security implications.

Domain accounts support centralized management, authentication policy, group membership, and auditing. Local accounts are managed separately on each computer and can become difficult to control if they are duplicated across many systems.

Privileged local accounts also require careful management because compromise of a local administrator credential may provide full control of that computer.

## Key Takeaways

* Local accounts belong to one computer.
* Domain accounts are centrally managed through Active Directory.
* The account prefix helps identify the authentication source.
* Understanding account context is important when reviewing logon events and permissions.